Matrix (Synapse + Element + MAS)

What's inside (all isolated in their own Docker network): • Synapse — the reference Matrix homeserver, with native Sliding Sync (works with Element X mobile, no separate proxy). • MAS (Matrix Authentication Service) — modern OAuth2/OIDC login with rotating access tokens and Element X QR-code sign-in. Synapse delegates all authentication to it. • PostgreSQL — the database for both Synapse and MAS, dedicated to this instance. • Element Web — the browser chat client, served at the root URL. • An internal reverse proxy that splits a single domain into the Matrix API, the auth service, the .well-known delegation and the web client — so FEDERATION runs over port 443, no extra ports.

IMPORTANT — the "Server name" you set below becomes a permanent part of every user ID (@you:your-domain) and is baked into the database on first boot. It CANNOT be changed afterwards. Set it to the exact domain you will attach to this instance (e.g. matrix.example.com), then attach that same domain under Hosting. Federation, well-known delegation, the auth service and the web client all derive from it.

The agent generates the database and server secrets on first install and keeps them on the device — Obacht never sees them. The first admin account is seeded into MAS from the username/password you set here. Self-service registration is closed by default; create more users from the admin account.

Scope: chat + federation. Voice/video calls (Element Call / LiveKit) are intentionally not included — they need a UDP media port range that the device's container sandbox does not expose.

Heavier than most bundles: budget ~1.7 GB RAM under load. Raspberry Pi 4 (4 GB+) works; Pi 5 is more comfortable.